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ABSTRACT 

Fault  Tree  Analysis  is  a  method  implemented  through  the 
use  of  logic  symbols,  for  analyzing  either  qualitatively  or 
quantitatively  the  events  that  lead  to  a  mission  or  system 
failure.   This  work  examines  an  Anti-Aircraft  Warfare  (AAW) 
scenario  restricted  to  the  defense  of  an  aircraft  carrier. 
A  fault  tree  of  the  events  that  lead  to  a  hit  on  the  carrier 
is  displayed  logically  from  the  top  down.   Fault  tree  anal- 
ysis when  applied  to  the  AAW  model  is  examined  with  a  view 
toward  its  usefulness  as  an  instructional  and  a  predictive 
tool . 
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I.   INTRODUCTION 

A.   BACKGROUND 

The  application  of  Fault  Tree  Analysis  (FTA)  to  commer- 
cial and  military  systems  has  been  ongoing  for  several  de- 
cades.  It  has  been  used  to  one  degree  or  another  in  industries 
such  as  aerospace,  electronics,  chemical  processing,  nuclear 
reactor  containment,  construction  and  transportation.   It 
has  evolved  from  a  method  for  the  design  and  diagnosis  of 
safe  systems  to  one  that  also  has  applicability  in  Reliabil- 
ity Engineering.   The  more  general  term.  Event  Tree  Analysis, 
refers  to  a  method  for  examining  the  events  that  lead  to  either 
mission  success  or  mission  failure.   The  more  restrictive 
term.  Fault  Tree  Analysis,  refers  to  a  failure  oriented  anal- 
ysis.  Hence  the  top  event  in  a  fault  tree  has  generally  an 
event  description  that  depicts  mission  or  system  failure. 
Most  of  the  events  in  a  fault  tree  that  support  and  contri- 
bute to  the  top  events  are  undesirable  ones  and  are  appro- 
priately named  faults. 

With  minor  modifications  to  the  conventional  symbology 
used  in  current  FTA,  the  objective  of  this  work  is  to  pro- 
vide a  model  of  an  Anti-Aircraft  Warfare  (AAW)  scenario  from 
a  mission  failure  (or  defensive)  point  of  view. 

It  should  be  emphasized  that  the  methodology  used  in  this 
paper  has  the  potential  for  use  in  other  scenarios  either 
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operational  or  non-operational.   In  the  broader  sense  of  Event 
Trees,  the  potential  to  analyze  not  only  mission  failure  but 
the  more  positive  side,  mission  success  appears  to  be  unlimited 
The  results  can  be  used  as  both  a  quantitative  predictive 
and  a  qualitative  instructional  tool. 

The  inherent  objective  in  Fault  Tree  Analysis  is  to  pro- 
vide an  in  depth  analysis  that  is  understandable  by  others. 
This  requires  that  the  modelor  (or  analyst)  completely  spe- 
cify the  combinations  of  events  occurring  in  the  system,  and 
how  they  lead  to  the  top  event  through  a  logical  use  of  sym- 
bols and  graphs. 

In  FTA  one  of  the  quantitative  goals  is  to  compute  an 
overall  probability  of  mission  success  or  failure.   Simply 
stated,  FTA  will  predict  the  occurrence  of  the  top  event  with 
a  certain  probability.   The  AAW  model  examined  in  this  work 
is  not  used  as  a  quantitative  predictor  but  instead  examines 
in  a  qualitative  manner  the  events  that  lead  to  mission  failure. 

As  a  qualitative  tool  FTA  provides  a  method  when  properly 
used,  that  could  lead  to  the  discovery  of  events  or  combina- 
tions of  events  that  may  not  have  otherwise  been  recognized 
as  causes  of  the  event  being  analyzed.   For  further  discussion 
and  treatment  of  the  use  of  Fault  Tree  Analysis  it  is  suggested 
that  the  reader  consult  the  articles  contained  in  Barlow, 
Fussell  and  Singpurwalla,  [Ref .  1] ,  and  cited  in  Barlow,  [Ref . 
2]  . 
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B.   THE  ANTI-AIRCRAFT  WARFARE  MODEL 

The  tactical  importance  of  anti-aircraft  warfare  makes 
it  a  logical  choice  as  a  topic  for  Fault  Tree  Analysis.   In 
addition,  an  abundance  of  information  consistent  with  cur- 
rent tactical  thinking  on  the  AAW  problem  is  readily  avail- 
able and  adaptable  to  FTA.   Simply  stated,  the  AAW  problem 
concerns  the  destruction  of  enemy  air  platforms  and  airborne 
weapons  whether  launched  from  surface,  sub-surface  or  air 
platforms.   The  model  considered  in  this  work  is  for  the  AAW 
problem  restricted  to  air  platforms  that  launch  missiles 
against  U.S.  naval  aircraft  carriers  and  their  escorts.   The 
problem  scope  now  becomes  the  defense  of  an  aircraft  carrier 
against  long  range  bombers  (LRB's)  that  launch  long  range 
air-to-surface  missiles  (ASM's).   In  order  to  reduce  the  pro- 
blem to  one  that  is  manageable,  the  normally  assumed  360  degree 
circle  of  protection  that  is  required  about  the  carrier  now 
becomes  a  smaller  sector  of  undefined  size  where  one-on-one 
engagement  analysis  is  performed.   This  is  not  an  unreasonable 
assumption  with  the  state  of  alertment  associated  with  today's 
early  warning  detection  systems  and  military  intelligence 
systems.   Applying  fault  tree  methodology  from  the  defensive 
point  of  view,  the  top  event  corresponds  to  the  aircraft  car- 
rier being  hit  by  one  air-to-surface  missile  (ASM)  launched 
from  a  long  range  bomber  (LRB)  at  some  standoff  launch  range. 
The  aircraft  carrier  is  protected  in  the  sector  by  airborne 
early  warning  aircraft,  long  range  combat  air  patrol  aircraft 
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(CAP)  and  medium  range  CAP,  a  long  range  surface-to-air  mis- 
sile (SAM)  ship,  a  short  range  SAM  ship  and  the  carrier's 
own  self  defense  system  (commonly  called  point  defense  sys- 
tem) .   By  convention  the  model  is  developed  "top  down"  through 
the  contributory  events  that  build  to  a  hit  on  the  carrier. 
During  application  however,  the  flow  of  occurrences  through 
the  logic  gates  is  directed  upward. 

C.   SUMMARY 

In  summary,  this  paper  examines  a  modified  version  of 
Fault  Tree  Analysis  applied  to  an  Anti-Aircraf t  Warfare  sce- 
nario.  The  features  of  event  tree  analysis  are  examined  with 
a  look  toward  both  quantitative  and  qualitative  application. 
Finally  an  examination  of  how  this  methodology  may  be  used 
in  other  operational  or  non-operational  scenarios  is  conducted 
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II.   EVENT  TREE  CONSTRUCTION 

A.   EVENT  SYMBOLOGY 

The  top  event  in  a  fault  tree  is  generally  some  undesired 
system  state  resulting  from  a  combination  of  undesired  sub- 
system states.   Since  the  tree  is  developed  top  down,  the 
top  event  must  be  carefully  and  thoughtfully  defined  and  then 
the  tree  developed  by  modelers  or  analysts  who  have  a  fairly 
detailed  understanding  of  the  system  and  who  can  translate 
that  knowledge  into  a  graphical  representation. 

The  methodology  for  Fault  Tree  Analysis  that  has  been 

adopted  in  this  paper  is  a  simplification  of  the  standard 

methodology  found  in  current  works  on  Fault  Tree  Analysis. 

Specifically,  the  symbology  used  in  Barlow  and  Lambert,  [Ref. 

3],  and  Young  [Ref.  4],  has  been  modified  for  the  convenience 

of  using  computer  generated  graphics  to  display  the  AAW  model. 

The  EVENT  symbology  used  in  this  work  does  not  alter  the  logic 

or  the  event  sequence  associated  with  the  symbology  cited 

in  the  references.   Although  it  replaces  the  use  of  the  four 

event  symbols  in  Figure  2.1  by  a  single  symbol,  the  rectangle, 

used  to  display  all  events  in  the  model,  no  information  is 

lost  in  this  representation.   Within  the  rectangle  an  undesired 

system  state  is  defined.   Whether  or  not  it  is  classified 

as  a  primary  event,  a  secondary  event,  an  undeveloped  event 

or  a  switch  event  is  not  important  in  the  application  presented 

here . 
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FAULT  EVENT 

or 
INPUT  EVENT 

or 
OUTPUT  EVENT 

or 
SUCCESS  EVENT 


PRIMARY       UNDEVELOPED 

or  or 

BASIC  EVENT   SECONDARY  EVENT 


SWITCH 
EVENT 


Figure  2 . 1   FTA  SYMBOLOGY 

B.   LOGIC  SYMBOLOGY 

The  two  most  often  used  symbols  to  connect  the  contri- 
butory events  to  the  top  event  are  the  two  logic  gates,  the 
AND  gate  and  the  OR  gate.   In  a  mathematical  sense  the  AND 
gate  represents  set  intersection  while  the  OR  gate  represents 
set  union.   In  Figure  2.2  undesired  Event  One  will  result 
only  if  Event  Two  and  Event  Three  and  Event  Four  occur.   Event 
One  is  the  result  of  transmitting  Events  Two,  Three  and  Four 
through  the  AND  gate.   To  illustrate  the  use  of  the  OR  gate, 
undesired  Event  Five  will  result  if  at  least  one  of  the  events. 
Six,  Seven  or  Eight  occur.    By  transmitting  Events  Six,  Seven 
and  Eight  through  the  OR  gate.  Event  Five  will  result.   The 
tree  is  structured  so  that  all  events  lead  sequentially  and 


The  symboloqy  used  here  follows  closely  the  symbology 
used  in  current  work  with  the  exception  that  some  modelers 
use  a  combinatorial  OR  gate  such  as  1  out  of  3,  or  2  out  of 
4,  etc. 
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logically  to  the  top  event,  and  all  are  related  to  the  top 
event  by  AND  and  OR  gates. 


EVENT 
ONE 

EVENT 
FIVE 

AND 

A 

1 

1 

1        1 

EVENT 
TWO 

EVENT 
THREE 

EVENT 
FOUR 

EVENT 
SIX 

EVENT 
SEVEN 

EVENT 
EIGHT 

AND 


OR 


Figure  2.2   LOGIC  SYMBOLOGY 

C.   SUCCESS  TREE  VERSUS  FAULT  TREE 

The  term  "success  tree"  to  which  prior  reference  has  not 
been  made  is  another  application  of  event  tree  analysis  that 
can  result  in  a  better  understanding  of  the  system  being  anal- 
yzed.  To  contrast  the  use  of  success  trees  and  fault  trees, 
consider  the  Initial  Scenario  proposed  in  the  illustration 
below.   The  illustration  forms  the  basis  for  the  AAW  model 
examined  later. 

The  Initial  Scenario  can  be  stated  as  follows:  The  carrier 
is  attacked  by  a  single  aircraft.   The  aircraft  attempts  to 
close  to  a  range  which  permits  the  launch  of  its  one  air- 
to-surface  missile.   The  Initial  Scenario  is  displayed  in 
Figure  2.3. 

From  a  defensive  point  of  view  the  modeler  could  apply 
either  of  the  two  methods,  Fault  Tree  Analysis  or  Success 
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Tree  Analysis  to  logically  symbolize  the  events  that  lead 
to  the  top  event.   His  choice  may  be  purely  one  of  prefer- 
ence or  there  may  be  underlying  assumptions  that  would  cause 
him  to  choose  one  method  over  the  other.   To  illustrate  the 
dual  relationship  that  exists  between  the  two  trees,  consider 
the  events  that  are  displayed  in  Figures  2.4  and  2.5.   These 
figures  develop  the  tactical  scenario  displayed  in  Figure 
2.3. 


ASM  LAUNCH 
RAMGEv 


o 


RAID 


Figure  2 . 3   INITIAL  SCENARIO 
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Figure  2.4  shows  a  success  tree,  with  application  of  the 
OR  gate.   It  relates  a  top  event  which  is  favorable  to  the 
defense  to  the  contributing  favorable  events. 

Figure  2.5  shows  a  fault  tree,  with  application  of  the 
AND  gate.   It  relates  a  top  event  which  is  unfavorable  to 
the  defense  to  contributing  unfavorable  events. 

In  addition  to  providing  graphic  representation  of  suc- 
cess tree  versus  fault  tree  methodology,  the  "dual  analysis" 
displayed  in  Figures  2.4  and  2.5  illustrate  the  simple  manner 
in  which  the  OR  gate  and  the  AND  gate  can  be  used  interchange- 
ably by  negating  the  top  event  (or  any  fault/success  event) . 


CARRIER  NOT  HIT 


RAID  DOES  NOT  PENETRATE: 
ATTACKING  AIRCRATT 
DOES  NOT  PENETRATE  TO 
ASM  LAUNCH  RANGE 


MISSILE  DOES  NOT  HiTt 
SOME  FAILURE  OF  THE  ASM 


Figure  2.4   SUCCESS  TREE  WITH  OR  GATE  APPLIED 
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The  Initial  Scenario  and  the  contributing  examples  are 
extracted  from  unpublished  notes  by  J.D.  Esary,  Professor 
of  Operations  Research  and  Statistics,  Naval  Postgraduate 
School.   The  probability  analysis  of  Appendix  A  is  extracted 
from  the  same  notes. 


RAID  PCNETRATESt 

ATTACXIHC  AlfKMFT 
PC^CTRATES   TO  ASM 
LAUNCH  RAMCE 


MISSILE  FlflED  A«  HITS: 

ASM   IS  LAUNOCO.   POCTRATES 
ANTIMISSILE  OErEMSES.  FD«S 
TMC   CA«RIER,   AK)  HITS  TAHCET 


Figure  2.5   FAULT  TREE  WITH  AND  GATE  APPLIED 

D.   IMPLEMENTATION 

The  model  examined  in  this  work  uses  Fault  Tree  meth- 
odology while  using  the  symbology  similar  to  that  indicated 
in  Figures  2.4  and  2.5.   The  most  notable  difference  is  that 
both  the  AND  and  OR  gates  are  represented  by  one  shape  and 
that  shape  is  rotated  180  degrees  from  those  of  Figures  2.4 
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and  2.5.   This  shape  will  become  familiar  in  the  next  chapter 
Since  the  model  is  too  large  to  fit  on  one  sheet  of  standard 
size  paper,  "off  page"  connectors  are  used  to  continue  the 
model  on  subsequent  pages.   The  off  page  connector,  a  small 
circle  with  the  connector  page  number  located  inside,  is  eas- 
ily located  on  each  page  of  the  model.   Logic  gates  and  off 
page  connectors  used  throughout  this  work  are  displayed  in 
Figure  2.6. 


or 


M2 


© 


LOGIC  GATES 


OFF  PAGE  CONNECTORS 


Figure  2.6   LOGIC  GATES  AND  OFF  PAGE  CONNECTORS 
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III.   FAULT  TREE  MODEL 

A.   DEFENSE  IN  DEPTH 

Although  the  objective  of  this  work  is  not  to  examine 
the  tactics  used  by  a  modern  naval  combatant  task  force  against 
a  long  range  bomber/antiship  missile  threat,  an  under- 
standing of  the  defensive  concepts  used  in  such  a  scenario 
will  assist  in  the  understanding  of  the  model. 

The  air  defense  of  the  U.S.  naval  battle  group  is  cen- 
tered on  the  aircraft  carrier  and  is  based  on  the  aggregate 
support  from  all  of  the  elements  in  the  group.   This  concept 
is  called  defense- in  depth.   Three  zones  of  defense  are  used 
to  describe  defense  in  depth.   Various  weapons  systems  are 
employed  at  different  ranges  to  prevent  the  penetration  of 
enemy  platforms  (Long  Range  Bombers  or  ASCM's).   The  defensive 
barriers  that  are  implied  here  are  created  by  long  range  and 
medium  range  CAP  aircraft  in  the  Outer  Defense  Zone;  by  long 
range  and  short  range  SAM  ships  in  the  Inner  (or  Area)  Defense 
Zone;  and  by  the  individual  ships  point  defense  systems  in 
the  Self  Defense  Zone.   The  geographical  boundaries  to  each 
zone  have  been  generally  defined  and  are  based  on  the  maximum 
ranges  of  the  various  weapons  systems.   With  modern  weapons 
systems  the  ranges  become  somewhat  flexible  and  in  many  cases 
overlap.   This  is  especially  evident  when  one  considers  the 
maximum  range  of  the  air  intercept  missiles  (AIM's)  used  by 
fighter  aircraft  versus  the  range  of  the  LR  SAM. 
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The  problem  with  overlapping  weapons  coverage  is  truly 
a  dynamic  one  that  results  in  subsequent  weapons  allocation 
problems.   When  one  considers  the  speed  of  the  incoming  ASCM, 
this  problem  becomes  even  more  evident.   Once  the  ASCM  is 
detected,  very  little  time  remains  to  decide  on  the  best  meth- 
od to  counter  the  penetrator.   This  problem  exists  not  only 
in  the  inter  zone  sense  (CAP  vs  LR  SAM  for  example)  but  also 
in  the  intra  zone  sense  (which  CAP  or  LR  SAM  platform  to  as- 
sign) .   For  the  AAW  scenario  the  task  of  assigning  weapons 
to  ASCM  (or  LRB)  is  the  responsibility  of  the  ANTI-AIR  WAR- 
FARE COMMANDER.   The  problem  becomes  more  severe  when  electronic 
warfare  measures  are  employed  by  both  the  offensive  and  defen- 
sive platforms  to  degrade  the  opponent's  use  of  electromagnetic 
radiation. 

Outer  Air  Defense  Zone  tactics  are  designed  to  allow  outer 
air  defense  forces  to  detect  and  destroy  antishin   cruise 
missile  (ASCM)  platforms  (LRB's)  before  the  launch  of  the 
ASCM.   Accompanying  the  long  range  bombers  are  electronic 
jamming  aircraft,  commonly  called  STRIKE  SUPPORT  aircraft, 
that  provide  electronic  support  and  protection  of  the  LRB's 
at  STANDOFF  ranges.   Outer  defense  zone  tactics  further  in- 
clude the  destruction  of  these  platforms.   The  scenario  modeled 
in  this  work  does  not  explicitly  include  the  attempt  to  knock 
down  these  platforms,  however  the  jamming  provided  by  the 
strike  support  aircraft  is  modeled. 
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Since  the  primary  objective  of  the  LRB  is  to  target  the 
carrier  and  subsequently  launch  an   ASCM,  the  advantageous 
position  from  which  to  do  this  is  at  the  maximum  range  from 
the  task  force.   The  LRB  thereby  reduces  time  in  which  he 
is  exposed  to  the  task  force  CAP  aircraft.   This  range  gen- 
erally corresponds  to  the  maximum  range  of  the  ASM  and  is 
termed  the  STANDOFF  launch  range. 

The  LRB  uses  active  radar  to  accomplish  this  task,  an 
active  radar  that  may  be  vulnerable  to  electronic  counter- 
measures  by  members  of  the  battle  group.   The  term  that  is 
applied  to  the  use  of  electronic  countermeasures  by  the  bat- 
tle force  is  COUNTERTARGETING.   As  the  term  implies,  COUNTER- 
TARGETING  is  the  use  of  active  or  passive  jamming  to  reduce 
the  range  at  which  the  long  range  bomber  can  accurately  de- 
tect and  target  the  aircraft  carrier. 

What  we  have  seen  in  the  Outer  Air  Battle  is  a  reduction 
in  the  number  of  standoff  jammers  with  the  use  of  CAP  air- 
craft.  The  attrition  of  standoff  jammers  is  essential  to 
the  defense  of  the  carrier  if  the  battle  group  radars  are 
expected  to  detect  ASM  platforms  before  cruise  missile  launch 
Outer  air  battle  forces  thus  reduce  the  number  of  attackers 
that  penetrate  to  the  Inner  Defense  Zone.   Finally,  the  outer 
air  forces  are  used  to  destroy  loitering  or  retiring  long 
range  bombers  so  that  follow-on  raids  are  less  severe. 

Before  proceeding,  it  may  be  advisable  to  consider  the 
tradeoffs  that  exist  in  the  Outer  Air  Battle  when  offensive 
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and  defensive  electronic  countermeasures  are  employed.   The 
offensive  LRB  prefers  to  target  the  carrier  at  maximum  stand- 
off range  in  order  to  launch  the  ASM  (which  needs  no  further 
guidance  from  the  bomber  once  launched) .   The  LRB  thus  re- 
duces his  exposure  to  the  layered  defensive  forces.   The  trade- 
off here  stems  from  the  fact  that  at  maximum  standoff  range 
the  targeting  problem  is  more  severe  than  at  reduced  ranges 
where  targeting  solutions  are  more  accurate.   Thus  the  effec- 
tiveness of  his  attack  is  reduced.   Conversely  the  defensive 
forces,  or  battle  group,  use  electronic  means  to  increase 
the  targeting  problem  and  thereby  force  the  bombers  to  pro- 
ceed to  ranges  more  precarious  to  their  survival.   More  im- 
portantly, the  probability  that  an  ASCM  is  launched  is  reduced. 

In  the  Area  Defense  Zone  long  range  and  short  range  sur- 
face-to-air missiles  are  employed  to  destroy  penetrating  ASCM's 
Electronic  countermeasures  are  used  to  deceive  the  ASCM's. 
Depending  on  the  effectiveness  of  the  countertargeting,  an 
additional  problem  of  command  and  control  exists  with  over- 
lapping engagement  zones.   CAP-SAM  coordination  is  necessary 
to  prevent  engagement  of  defender-on-defender .   The  coordi- 
nation of  inner  defense  weapons  is  necessary  to  prevent  over- 
engagement  of  one  target  while  others  remain  unengaged.   Thus 
real-time  management  of  weapon  resources  is  mandatory  in  the 
hostile  environment  created  by  the  launch  of  an  ASCM. 

The  Self  Defense  Zone  constitutes  the  final  barrier  in 
the  defense  of  the  carrier.   This  zone  employs  point  defense 
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systems  (missiles  or  guns)  that  have  high  kill  probabilities 
to  destroy  the  ASCM's  that  have  penetrated  the  outer  zones. 

B.   ASSUMPTIONS 

The  AAW  model  examined  in  this  work  uses  the  defense  in 
depth  concept  to  describe  the  events  that  lead  to  a  hit  on 
the  carrier.   Prior  to  the  assembly  and  description  of  the 
fault  tree,  it  may  prove  useful  to  describe  the  tactical  and 
strategic  assumptions  that  were  used  to  design  the  model. 

The  assumptions  are: 

•  Carrier  battle  group  is  attacked  by  long  range 
bombers  in  open  ocean  transit. 

•  Antiship   cruise  missile  is  autonomous  after 
launch;  no  midcourse  update  or  corrections  are 
necessary  from  the  mother  aircraft. 

•  Antiship  cruise  missile  flight  profile  is  high 
altitude  in  the  cruise  phase  and  steep  angle  of 
attack  in  the  dive  phase. 

•  All  defensive  forces  are  modern  platforms  that 
are  equipped  with  the  latest  variant  of  Navy 
Tactical  Data  System  (NTDS) . 

•  Outer  air  battle  forces  are  comprised  of  Early 
Warning  (AEW)  and  fighter  aircraft  using  vector 
logic  techniques  for  detection,  tracking  and 
engagement  of  hostile  platforms. 
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•  Although  there  may  be  many  LRB ' s  in  the  raid 
that  attack  the  carrier,  this  analysis  deals 
with  only  one  small  sector  close  to  the  threat 
axis . 

•  Each  LRB  has  only  one  ASCM. 

•  Salvo  doctrine  for  the  defensive  forces  is  im- 
plicit and  imbedded  in  the  fault  tree;  i.e.,  how 
many  missiles  it  takes  to  hit  the  ASCM  is  not 
important,  just  that  the  event  did  or  did  not 
happen. 

•  Approximate  threat  axis  is  known. 

•  Area  defensive  forces  are  NTDS  equipped. 

•  Long  range  missile  ship  employs  Terrier  missile 
system  to  intercept  the  ASCM. 

•  Short  range  missile  ship  employs  Tartar   mis- 
sile system  to  intercept  the  ASCM. 

•  LR  SAM  ship  is  positioned  for  cruise  phase  inter- 
cept of  the  ASCM. 

•  SR  SAM  ship  is  positioned  for  dive  phase  inter- 
cept of  the  ASCM. 

•  LR  and  SR  SAM  ships  have  electronic  warfare  suites 
permitting  countertargeting  techniques. 

•  Composite  Warfare  Commander  (CWC)  doctrine  is  used. 

•  Countertargeting,  when  effective,  is  only  effective 
in  the  Outer  Defense  Zone. 
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•  Some  probability  exists  for  a  LR/MR  CAP  to 
intercept  the  high  altitude  ASCM  with  CAP-fired 
air  intercept  missiles  (AIM's). 

C.   THE  MODEL  (EXPANDED  VERSION) 

Since  the  model  was  developed  top  down  to  conform  to  the 
convention  in  Fault  Tree  Analysis,  the  top  event  is  assigned 
"Carrier  is  hit" .   As  previously  discussed  it  is  the  major 
event  to  which  all  subevents  subscribe.   To  get  an  overview 
of  the  events  that  must  be  further  developed  the  following 
analysis  is  provided. 

The  event  "CARRIER  IS  HIT"  is  a  result  of: 

•  Missile  penetrates  point  defense  systems. 

•  Missile  penetrates  short  range  SAM  ship  defense. 

•  Missile  penetrates  long  range  SAM  ship  defense. 

•  Missile  penetrates  LR/MR  CAP  defenses. 

•  Missile  launched  from  long  range  bomber. 

•  Countertargeting  is  effective,  LR  bomber  penetrates 
LR/MR  CAP  defenses  to  reduced  launch  range. 

OR 
Countertargeting  is  ineffective;  LRB  penetrates 
LR/MR  CAP  defenses  to  standoff  launch  range. 
The  events  listed  above  are  the  major  subsections  of  the 
model.   Figure  3.1  displays  these  major  events  by  block  dia- 
gram.  Developing  the  sub  events  that  appear  in  Figure  3.1 
and  applying  fault  logic  to  the  model  is  the  next  step  in 
the  procedure . 
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D.   HOW  TO  READ  THE  MAJOR  SUBEVENTS 

The  block  diagram  presented  in  Figure  3.1  was  used  as 
a  starting  point  to  gain  an  overall  appreciation  for  the  model 
An  expanded  version  of  the  model  with  fault  tree  symbology 
applied  is  presented  in  Figure  3.2  and  continued  in  Figure 
3.3.   The  model  was  developed  from  the  block  diagram  using 
a  "tiered"  approach.   Each  tier  represents  a  combination  of 
subevents  that  are  linked  together  with  logic  gates.   Each 
tier  is  in  actuality  composed  of  many  subevents  but  only  the 
major  events  are  displayed  in  Figures  3.2  and  3.3.   The  num- 
bers that  appear  in  parentheses  adjacent  to  each  block  (or 
group  of  blocks)  in  Figure  3.1  correspond  to  the  tiers  in 
Figures  3.2  and  3.3.   The  tiers  are  correspondingly  numbered 
also.   The  tiers  represent  specific  levels  of  defense  through 
which  the  ASCM  must  penetrate. 

Applying  this  nomenclature  and  using  the  Defense  in  Depth 
concept,  block  (1)  in  Figure  3.1  relates  to  the  Self  Defense 
Zone.   This  corresponds  to  tier  (1)  in  Figure  3.1.   Similarly, 
blocks  (tiers)  (2)  and  (3)  represent  the  Area  Defense  Zone 
and  blocks  (tiers)  (4)  through  (6)  relate  to  the  Outer  Defense 
Zone . 

1 .   First  Tier 

The  Self  Defense  Zone  of  the  carrier  is  developed 
from  the  primary  fault  event  of  the  tree  or  the  top  event. 
The  event  "Carrier  is  hit"  results  from  two  events  that  com- 
prise the  first  tier  of  the  model.   The  ASCM  must  first 
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penetrate  the  POINT  DEFENSE  system  of  the  carrier  and  the 
ASCM  must  function  properly  in  the  terminal  (homing)  de- 
scent phase. 

It  should  be  noted  that  the  model  presented  here  is 
a  one  sided  model,  because  the  events  displayed  represent 
only  the  faults  of  the  defensive  force  (the  battle  group) . 
With  few  exceptions,  the  faults  (or  successes)  of  the  offen- 
sive force  are  not  presented.   One  instance  that  is  contrary 
to  this  convention  occurs  in  the  first  tier.   The  event  "ASCM 
systems  function  properly"  is  a  major  offensive  force  event. 

2.  Second  Tier 

ASCM  penetration  of  the  carrier  SELF  DEFENSE  ZONE 
is  a  result  of  two  major  subevents:  (a)  the  missile  has  pen- 
etrated the  SR  SAM  ship  DEFENSE  ZONE  and  (b)  the  missile  has 
evaded  the  carrier's  Point  Defense  Zone.   Event  (b)  does  not 
appear  in  Figure  3.2.   It  is  the  implicit  combination  of  two 
events  that  are  connected  through  a  logic  gate.   The  evasion 
of  the  carrier's  point  defense  system  is  a  result  of  the  union 
of  two  events:  either  (bl)  carrier  fires  it's  point  defense 
system  at  the  ASCM  and  misses  or  (b2)  the  carrier  does  not 
fire. 

3.  Third  Tier 

Tier  (3)  represents  the  final  tier  in  the  Inner  Defense 
Zone.   The  penetration  of  the  ASCM  through  the  SR  SAM  ship 
defense  is  a  result  of  transmitting  the  event  "ASCM  penetrates 
through  LR  SAM  ship  defense"  and  ASCM  evasion  of  the  SR  SAM 
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ship  defense  through  an  AND  gate.   ASCM  evasion  of  the  SR 
SAM  ship  defense  is  not  an  explicit  event  in  Figure  3.2  but 
a  combination  of  two  events  that  are  connected  by  an  OR  gate: 
either  (a)  the  SR  SAM  ship  fires  and  misses  or  (b)  the  SR 
SAM  ship  does  not  fire. 

4 .  Fourth  Tier 

The  penetration  of  the  ASCM  through  the  LR  SAM  ship 
defense  is  a  result  of  ASCM  penetration  through  the  CAP  de- 
fenses and  the  intersection  of  ASCM  evasion  of  LR  SAM  ship 
defense  indicated  in  Figure  3.3.   The  latter  event  is  a  com- 
bination of  two  events:  (a)  LR  SAM  ship  fires  a  LR  SAM  and 
misses  or  (b)  LR  SAM  ship  does  not  fire.   These  events  are 
transmitted  through  an  OR  gate. 

5.  Fifth  and  Sixth  Tiers 

ASCM  penetration  to  the  Inner  Defense  Zone  is  a  re- 
sult of  many  fault  events  in  the  Outer  Air  War.   To  put  it 
into  perspective,  return  to  Figure  3.1.   The  ASCM  is  launched 
from  a  long  range  bomber  at  a  position  within  the  maximum 
range  of  the  ASCM  after  the  mother  aircraft  has  gained  accu- 
rate targeting  information  on  the  carrier.   Depending  on  the 
effectiveness  of  the  countertargeting  efforts  of  the  battle 
force,  the  ASCM  will  be  launched  either  from  a  STANDOFF  launch 
range  or  from  a  REDUCED  launch  range . 

Return  now  to  Figure  3.3.  At  tier  (4),  ASCM  pene- 
tration through  the  CAP  defenses  is  a  result  of  connecting 
the  essential  event  of  tier  (5)  "ASCM  is  launched  from  REDUCED 
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launch  range"  with  the  essential  event  of  tier  (6)  "ASCM  is 
launched  from  STANDOFF  launch  range".   These  tiers  are  con- 
nected by  an  OR  gate.   Tiers  (5)  and  (6)  are  further  devel- 
oped in  Figure  3.3.   Referring  to  tier  (5),  once  launched, 
the  ASCM  must  evade  the  CAP-fired  AIM'S.   The  two  events  (a) 
"ASCM  is  launched  from  a  REDUCED  launch  range"  and  (b)  "ASCM 
evades  LR/MR  CAP  defense"  are  connected  by  an  AND  gate.   The 
ASCM  is  launched  from  REDUCED  launch  range  because  the  events 
"COUNTERTARGETING  ..."  and  "LR  bomber  evades  LR/MR  CAP  defenses" 
are  transmitted  through  an  AND  gate. 

A  parallel  analysis  can  be  seen  in  tier  (6)  for  the 
ASCM  launched  at  STANDOFF  range. 
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IV.   THE  DETAILED  MODEL 

Chapter  III  presented  the  AAW  model  in  an  expanded  ver- 
sion.  A  tiered  approach  was  developed  to  gain  an  apprecia- 
tion for  the  construction  of  the  model.   The  intention  in 
the  present  chapter  is  to  detail  the  model. 

A.   SELF  DEFENSE  (TIER  1) 

The  fault  events  that  contribute  to  the  penetration  of 
the  ASCM  through  the  self  defense  system  of  the  carrier  are 
displayed  in  Figure  4.1.   The  primary  difference  between  the 
events  of  Figure  4.1  and  those  of  Figure  3.2  is  the  expansion 
of  the  major  subevent  in  Figure  3.2:  "Carrier  fires  ...  and 
misses".   Three  events  connected  by  an  AND  gate  describe  this 
event.   Consider  the  first  event  (reading  left  to  right). 
In  order  to  fire  the  ASCM  there  must  be  a  fire  control  solu- 
tion generated  on  the  carrier.   Once  the  solution  is  found 
by  the  fire  control  system  (block  2),    the  carrier  fires  at 
the  ASCM  and  misses. 

The  events  that  lead  to  a  fire  control  solution  are  pre- 
sented in  Figure  4.2.   The  events  are  connected  to  Figure 
4.2  by  the  "fcs"  off  page  connector.   Events  similar  to  those 
of  Figure  4.2  are  used  throughout  this  work  since  a  fire  con- 
trol solution  must  be  performed  prior  to  firing  any  weapon. 
Conceptually  there  is  little  difference  in  generating  a  fire 
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control  solution  whether  on  the  carrier  or  on  another  NTDS 
equipped  vessel.   Furthermore,  although  the  details  of  this 
analysis  imply  NTDS,  the  development  is  general  enough  to 
use  for  non-NTDS  equipped  platforms. 
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Figure  4.2   FIRE  CONTROL  SOLUTION  GENERATED 

The  blocks  enclosed  by  the  dashed  line  in  Figure  4.2  are 
read  as  follows:  a  target  has  been  designated  "hostile"  by 
some  other  unit  (AEW,  LR  SAM  SHIP,  CAP) ;  the  target  is  de- 
tected by  the  carrier's  radar  and  and  the  symbol  that  appears 
on  the  NTDS  console  (visual  display)  matches  the  hostile 
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designation.   A  fire  control  system  (there  may  be  more  than 
one)  on  the  carrier  is  designated  to  perform  the  task  of  firing 
the  weapon  at  the  ASCM.   The  fire  control  system  "acquires" 
the  target  and  then  "tracks"  the  target.   Finally,  a  "solution" 
to  the  intercept  problem  (Point  Defense  versus  ASCM)  is  com- 
puted.  All  of  the  events  that  are  enclosed  by  the  dashed 
line  must  happen  in  order  to  close  the  loop,  therefore  the 
events  are  connected  by  an  AND  gate. 

Detection  of  the  target  with  a  ship's  own  radar  is  con- 
strained by  the  electronic  measures  taken  by  the  STRIKE  SUPPORT 
aircraft.   In  order  to  detect  the  target,  either  "No  ECM  is 
conducted  ..."  or  "ECM  is  conducted  ...".   If  the  latter  is 
the  case  then  ECM  is  countered  by  the  self  defense  system. 
These  events  are  displayed  in  Figure  4.2. 

The  event  "carrier  point  defense  system  does  not  fire" 
in  Figure  4.1  is  supported  (via  the  "cpds"  connector)  by  events 
displayed  in  Figure  4.3.   The  system  does  not  fire  for  one 
of  several  reasons:  either  (1)  the  "Fire  control  (FC)  solu- 
tion is  not  generated"  or  (2)  the  "FC  solution  is  generated 
but  a  command  and  control  problem  prevents  firing"  or  (3) 
the  "fire  control  solution  is  generated  and  the  launcher 
malfunctions" . 

The  FC  solution  events  in  Figure  4»3  are  supported  by  the 
events  displayed     in  Figure  4.4.   The  hostile  target  is 
not  engageable  because  (a)  either  the  target  is  out  of  the 
engagement  envelope  of  the  fire  control  system  (unlikely  in 
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this  case  since  the  ASCM's  goal  is  to  hit  the  carrier)  or 
(b)  the  detection  of  the  ASCM  is  gained  late  or  (c)  the 
detection  of  the  ASCM  is  not  made. 

To  amplify  the  meaning  of  the  off  page  connectors,  the 
following  conventions  apply.   The  acronym  "fcs"  represents 
"fire  control  solution",  "cpds"  represents  "carrier  point 
defense  system"  and  "nel"  translates  to  "not  engageable". 
Lower  case  connectors  move  "down"  the  page  and  connect  to 
minor  subevents  while  upper  case  connectors  generally  move 
"across"  the  page  and  connect  to  major  events  or  tiers.   This 
convention  is  relaxed  in  Figure  4.7  where  the  connectors  T5 
and  T6  tie  downward  rather  than  across  the  page. 
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B.   SR  SAM  SHIP  DEFENSE  (TIER  2) 

SR  SAM  ship  defense  system  events  are  connected  to  Fig- 
ure 4 . 1  by  the  "T2"  connector.   They  are  shown  in  Figure  4.5. 
Penetration  of  the  ASCM  through  the  SR  SAM  ship  defense  is 
similar  in  concept  to  the  first  tier.   In  general,  a  target 
(ASCM)  must  be  present  that  has  penetrated  a  previous  tier 
and  a  fire  control  solution  must  be  generated.   The  defensive 
platform  can  either  fire  or  not  fire  at  the  ASCM,  depending 
on  the  circumstances.   One  notable  difference  concerns  the 
four  events  enclosed  by  the  dashed  line.   It  relates  to  the 
position  of  the  ship.   Since  the  ASCM  is  targeted  for  the 
carrier,  ship  positioning  in  the  case  of  a  SR  SAM  ship  be- 
comes an  issue. 

The  four  blocks  represent  the  major  subevent  "SR  SAM  ship 
fires  SAM  at  ASCM  and  misses".   The  events  are  connected  by 
an  AND  gate.   Thus  all  events  must  occur  in  order  to  have 
a  firing.   The  first  event,  "FC  solution  ..."  is  supported 
by  the  contributory  events  listed  in  Figure  4.2. 

The  second  and  third  events  (reading  from  left  to  right) 
appear  to  be  similar  structurally  and  semantically  but  are 
separated  to  emphasize  the  issue.   Although  one  of  the  events 
places  the  SR  SAM  ship  in  the  approximate  location,  in  range 
and  on  the  AAW  axis  for  firing  the  SAM,  the  event  is  included 
as  a  necessary  ingredient  to  the  problem  solution.   If  not 
positioned  optimally,  the  probability  of  hitting  the  ASCM 
becomes  less  than  desired.   In  addition  to  positioning,  timing 
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the  SAM  launch  is  important.   Consequently  the  event  "ASCM 
within  launch  window  of  SR  SAM  ship"  is  included  in  this 
analysis. 

The  fourth  event  enclosed  in  the  dashed  box  in  Figure 
4.5,  "SR  SAM  ship  fires  SAM  at  ASCM  and  misses"  is  self  ex- 
planatory.  The  remaining  fault  events  displayed  in  this  por- 
tion of  the  model  are  similar  to  those  of  the  previous  tier. 
Figure  4.1. 

C.  LONG    RA]MGE    SAM    SHIP    DEFENSE     (TIER    3) 

Long  range  SAM  ship  defense  is  shown  in  Figure  4.6  and 
connected  to  the  SR  SAM  ship  defense  tier  by  the  T3  connector. 
The  entire  complex  of  events  is  nearly  identical  to  that  for 
the  SR  SAM  ship  system.   The  problems  associated  with  pre- 
venting further  penetration  of  the  ASCM  are  similar  in  either 
case,  however  the  fire  control  solutions  are  somewhat  differ- 
ent.  Intercepting  the  ASCM  in  its  cruise  phase  represents 
a  problem  that  is  difficult  to  solve.   Further  analysis  of 
the  cruise  phase  intercept  is  outside  the  scope  of  this  work. 

D.  CAP  DEFENSE  (TIER  4) 

Although  the  use  of  CAP  aircraft  to  prevent  penetration 
of  an  ASCM  after  launch  is  arguable  from  a  practical  stand- 
point, the  event  is  included  in  the  analysis  because  it  re- 
presents a  low  probability  extreme.   To  omit  it  from  the  model 
would  be  inappropriate.   It  is  connected  to  the  events  of 
Tier  3  (LR  SAM  Ship  Defense)  by  the  "T4"  connector.   For  the 
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ASCM  to  penetrate  through  the  CAP  defenses  it  must  initially 
have  been  launched  by  the  LR  Bomber  at  either  a  STANDOFF  range 
or  a  REDUCED  standoff  range.   These  events  are  shown  in  Figure 
4.7.   Once  launched,  it  proceeds  to  high  altitude  through 
the  interceptors  defense.   ASCM  evasion  of  the  CAP  defenses 
is  shown  in  Figure  4.8.   It  is  joined  to  Figure  4 . 7  by  the 
"asm"  connector. 

Figure  4.8  is  symmetrical,  LR  CAP  and  MR  CAP  have  similar 
supporting  events,  however  only  the  subevents  associated  with 
the  MR  CAP  are  shown.   The  connectors  "Ircl"  and  "lrc2"  (re- 
ferring to  LR  CAP)  are  used  to  expand  the  events  that  lead 
to  "LR  CAP  does  not  fire"  shown  in  Figure  4.9  or  to  "LR  CAP 
fires  AIM  at  ASCM  and  misses"  shown  in  Figure  4.10. 

E.   ASCM  LAUNCHED  FROM  STANDOFF  RANGE 

Consider  the  case  where  the  long  range  bomber  has  target- 
ing information  that  will  allow  launching  the  ASCM  from  near 
maximum  range.   Figure  4.11  displays  the  contributing  events 
that  lead  to  ASCM  launch  at  long  range.   Countertargeting 
by  the  battle  force  has  been  ineffective  and  the  LR  bomber 
proceeds  to  launch  range  while  updating  the  targeting  infor- 
mation.  The  ASCM  is  then  launched  and  flies  to  its  preassigned 
destination  (carrier)  autonomously.   The  details  of  the  LR 
bomber  evading  the  LR  CAP  are  imbedded  in  Figure  4.11.   It 
should  be  noted  that  the  connectors  "fcs"  and  "nel"  support 
the  events  of  this  figure. 
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Figure  4.7   ASCM  PENETRATES  CAP  DEFENSE  TO  INNER  DEFENSE  ZONE 

F.   ASCM  LAUNCHED  FROM  REDUCED  RANGE 

This  section  deals  primarily  with  the  countertargeting 
problem  encountered  by  the  hostile  force.   As  previously  pos- 
tulated, it  is  the  intention  of  the  LR  bomber  to  launch  the 
missile  at  maximum  range  consistent  with  the  quality  of  the 
targeting  solution  and  the  bomber's  exposure  to  battle  force 
interceptors.   The  events  contributing  to  ASCM  launch  at  REDUCED 
range  are  displayed  in  Figure  4.12.   This  figure  integrates 
"degrees"  of  countertargeting  into  the  problem.   Countertar- 
geting is  initially  effective  so  the  LR  bomber  continues  inbound 
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Figure  4.9   LR  CAP  DOES  NOT  FIRE  AT  ASCM 

toward  the  carrier  until  either  the  LR  bomber  gains  accurate 
targeting  data  (and  launches)  or  the  LR  bomber  encounters 
resistance  with  the  outer  air  battle  interceptors.   Targeting 
range  is  not  well  defined  in  any  case  thus  the  supporting 
events  to  "ASCM  launch  at  REDUCED  range"  are  somewhat  flex- 
ible.  The  connectors  "lrc3"  and  "lrc4"  join  the  subevents 
that  relate  to  the  firing  or  nonfiring  of  AIM's  at  the  LR 
bomber.   Similarly,  "mrcl"  and  "mrc2"  refer  to  medium  range 
CAP  events  which  relate  to  the  firing  or  nonfiring  of  MR  CAP 
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Figure  4.10   LR  CAP  FIRES  AIM  AND  MISSES  ASCM 

launched  AIM's.   The  events  that  detail  CAP  launched  missile 
firings  at  the  LR  bomber  are  shown  in  Figures  4.13  through 
4.16. 
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V.   USEFULNESS  AND  CONCLUSIONS 

A.   QUALITATIVE  INSTRUCTIONAL  TOOL 

At  the  outset  of  this  work  a  discussion  was  initiated 
on  the  use  of  Fault  Analysis  as  a  quantitative  predictor  and 
a  qualitative  instructional  tool.   To  illustrate  these  con- 
cepts an  AAW  scenario  was  introduced  and  fault  tree  analysis 
was  applied  to  the  model. 

The  model  was  qualitatively  developed  using  fault  tree 
methodology  to  describe  the  flow  of  logic  that  is  necessary 
to  lead  to  mission  failure.   The  mission  in  this  case  was 
to  defend  a  carrier  against  ASM  attack. 

The  model  is  simple  enough  to  use  as  an  instructional 
device  for  primary  students  in  naval  warfare.   It  is  robust 
enough  to  use  as  a  diagnostic  tool  when  analyzing  the  tactics 
that  prevent  the  occurrence  of  the  top  event. 

The  flow  chart  style  of  annotation  in  FTA  is  compatible 
with  naval  warfare  scenarios.   One  of  the  features  of  a  flow 
chart  presentation  is  to  enable  a  student  client  to  gain  an 
appreciation  for  the  "big  picture".   By  viewing  the  AAW  sce- 
nario from  the  big  picture  vantage  point  it  enables  the  oper- 
ator at  the  radar  scope  level  to  better  understand  the  objective 
This  may  have  the  added  benefit  of  yielding  more  effective 
and  reliable  performance. 
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At  the  warfare  commander  level,  the  client  is  better  able 
to  identify  critical  combinations  of  successes  (or  failures) 
that  can  lead  to  a  more  efficient  allocation  of  personnel  and 
hardward  in  either  a  training  or  operational  environment. 

As  a  visual  tool,  it  can  be  used  for  communicating  results 
and  supporting  decisions  that  might  otherwise  seem  ambiguous. 

This  AAW  model  has  identified  the  "big  picture"  events  that 
lead  to  a  hit  on  the  carrier.   The  model  admits  detailed  analysis 
of  the  events  that  enter  throughout  the  model,  for  example,  the 
event  "Command  and  control  problem  prevents  firing  AIM  (LR  or  SR 
SAM)  at  ASCM" .   The  "command  and  control  problem"  at  any  stage 
is  one  of  the  more  important  inhibitors  of  efficient  operations 
in  naval  warfare.   It  is  also  one  of  the  most  difficult  to  solve. 
Developing  the  failure  event  labeled  "Command  and  control  ..." 
may  uncover  a  solution  to  the  problem  not  before  realized.   In 
addition,  a  problem  not  initially  recognized  as  a  problem  may 
emerge  and  coincidentally  be  solved.   Just  recognizing  the  pro- 
blem and  being  able  to  define  it  sometimes  leads  to  a  solution. 

Many  events  throughout  the  model  are  undeveloped.   One 
of  the  features  of  FTA  is  that  the  model  is  developed  top 
down.   Undeveloped  events  can  then  be  expanded  by  specialists 
using  relevant  experience  and  technical  knowledge.   For  ex- 
ample, the  event  in  Figure  4.2  "Fire  control  solution  is  gen- 
erated to  hit  the  hostile  target"  is  such  an  event. 

Little  emphasis  has  been  placed  in  the  model  on  the  elec- 
tronic measures  conducted  by  the  hostile  platform  to  prevent 
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detection  and  destruction  before  launch  of  the  ASCM.   In  real- 
ity this  area  receives  considerable  attention  and  it  is  of 
major  importance  to  both  sides.   It  is  an  event  to  which  con- 
siderable thought  and  research  has  been  devoted.   A  specialist 
in  electronic  warfare  could  develop  the  concepts  (events) 
and  provide  further  insight  into  the  problem. 

Finally,  by  considering  the  "dual"  of  the  fault  tree  or 
the  success  tree,  event  tree  analysis  can  be  a  corroborative 
aid  in  operational  planning.   By  developing  the  events  that 
lead  to  the  event  "Carrier  is  not  hit"  (the  complement  of 
the  model's  top  event)  the  warfare  commander  may  encounter 
an  aspect  of  the  problem  not  previously  viewed. 

B.   QUANTITATIVE  PREDICTIVE  TOOL 

The  objective  of  this  work  was  to  examine  event  tree 
analysis,  and  more  specifically  Fault  Tree  Analysis,  when 
applied  to  an  AAW  scenario.   The  scenario  was  developed  qual- 
itatively.  The  quantitative  aspects  of  the  analysis  were 
not  examined.   The  purpose  of  this  section  is  to  mention  the 
quantitative  possibilities  in  the  FTA  approach. 

Many  models  have  been  developed  in  AAW  that  use  gaming 
and  simulation  methodology.   Many  of  these  models  are  used 
in  the  instructional  environment  to  enhance  a  student's  tac- 
tical ability  to  use  and  understand  modern  platforms  and  wea- 
pons. Imbedded  in  the  games  are  probabilities  (based  on  assumed 
distributions)  of  specific  events  occurring  with  the  end  result 
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(in  this  case)  that  the  "Carrier  is  hit"  or  the  "Carrier  is 
not  hit"  depending  on  the  tactic  used  and  the  final  implicit 
probability. 

Proposed  from  this  model  is  not  so  much  the  stochastic 
result,  e.g.,  "with  .05  probability,  the  carrier  is  hit"  but 
in  a  broader  sense  the  sensitivity  of  that  result  to  various 
inputs  or  events.   The  model  as  presented  is  in  some  respects 
not  usable  for  such  an  analysis.   Given  further  embellishment 
however,  it  could  be  a  useful  tool  in  sensitivity  studies. 
To  help  with  the  problem  of  where  to  place  additional  emphasis 
to  reduce  the  probabilities  associated  with  the  end  or  inter- 
mediate results  is  certainly  an  inducement  to  use  it  in  oper- 
ational planning. 

The  issue  here  is  in  attempting  to  assign  probabilities 
that  are  clearly  subjective  arguments  on  the  stare  of  the 
system.   Many  assumptions  must  be  made  to  accomplish  these 
assignments,  including  a  problematic  one  about  the  indepen- 
dence of  events.   This  would  have  to  be  done  cautiously  in 
order  to  preserve  the  usefulness  of  the  sensitivity  study. 

An  example  of  how  the  Initial  Scenario  proposed  in  Chapter 
II,  and  described  graphically  in  Figure  3.2  might  be  quanti- 
fied is  given  in  APPENDIX  A.   A  more  detailed  analysis  is 
beyond  the  scope  of  this  work. 
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C.   OTHER  SCENARIOS 

Other  scenarios,  analagous  to  AAW  are  aptly  described 
by  a  fault  tree  or  a  success  tree.   Suppose  similar  scenarios 
were  developed  using  the  same  degree  of  detail  that  was  used 
in  the  AAW  model.   By  exposing  these  trees  to  the  critique 
of  students  and  warfare  commanders,  the  level  of  communica- 
tion and  understanding  at  all  echelons  could  be  increased. 
Below  are  listed  other  warfare  environments  and  scenarios 
that  are  amenable  to  analysis  using  event  trees. 

1.  AAW 

•  Submarine  launched  cruise  missiles  targeted  for 
the  carrier. 

•  Surface  launched  cruise  missiles  targeted  for  the 
carrier. 

•  Air-to-Air  engagement. 

•  SAM  engagements. 

2.  Anti-Surface  Warfare  (ASUW) 

•  Type  engagements  involving  combat  surface  vessels. 

3 .  Anti-Submarine  Warfare  (ASW) 

•  Submarine  versus  submarine  engagements. 

•  Submarine  versus  surface  ship  engagement. 

•  Surface  ship  versus  submarine  engagement. 

•  Submarine  versus  antisubmarine  aircraft  engagement. 
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APPENDIX  A 
PROBABILITY  ANALYSIS  OF  THE  INITIAL  SCENARIO 

A  typical  probability  analysis  of  the  Initial  Scenario 
would  proceed  along  the  lines  as  follows: 
P   =  P (Carrier  is  hit) 

=  P (Raid  penetrates,  missile  is  fired  and  hits) 
=  P (Missile  is  fired  and  hits/  Raid  penetrates) 
X  P(Raid  penetrates) 


where 


M 


and 


^M  =^  Pr 


=  P (Missile  is  fired  and  hits/Raid  penetrates) 
is  the  conditional  probability  that  the 
missile  succeeds  once  it  is  within  range 


P   =  P(Raid  penetrates 

K. 


is  the  probability  that  the  missile  can 
be  brought  within  range 
The  fault  tree  for  the  Initial  Scenario  expresses  the 
event  H  =  (Carrier  is  hit)  as  the  logical  "and"  of  the  event 
R  =  (Raid  penetrates)  and  M  =  (Missile  is  fired  and  hits) . 

The  event  H  is  the  consequence  of  transmitting  the  events 
R  and  M  through  the  "and"  gate.   In  the  same  vein,  the  pro- 
bability P„  can  be  viewed  as  the  result  of  transmitting  the 

n 

probabilities  P   and  P   through  the  "and"  gate. 
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R 


R 


P„  =  P„  A  P,,  =  P„  X  P,, 
H     R     M     R     M 


M 


M 


P,  A  P^ 


^  ^  ^2 


is  the  probabilistic  "and" 

of  the  probabilities  P,  and  P„ 


The  success  tree  for  the  Initial  Scenario  relates  the 
events  H  =  (Carrier  is  not  hit)  to  the  events  R  =  (Raid  does 
not  penetrate)  and  M  =  (Missile  does  not  hit).   The  events 
H,  R,  M  are  the  logical  opposites  of  the  events  H,  R  and  M. 

The  event  H  is  the  consequence  of  transmitting  the  events 
R  and  M  through  the  "or"  gate.   The  probability  Prj  can  be 

n 

viewed  as  the  result  of  transmitting  P=:  and  P^-:  through  the 

^   R      M      ^ 

"or"  gate. 

It  must  be  emphasized  that  the  probability  analysis  pre- 
sented illustrates  only  the  simplest  cases.   A  probability 
analysis  on  the  AAW  scenario  medeled  in  this  work  will  re- 
quire some  more  difficult  techniques. 
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P-  =  1  -  p 
H         H 

P-  =  1  -  P 
R         R 

P-  =  1  -  P 
M         M 


^H  =  ^R  ^  ^M 

=  ^R  ^  ^M  -  ^^R  ^  ^M^ 
=  1  -  (1  -  P^)   (1  -  P-) 


^M 


P^  V  P^  =  P^  +  P2  -  (Pi  X  P^) 


=  1  -  (1  -  P. 


1  -  P2) 


is  the  probabilistic  "or"  of 
the  probabilities  P,  and  P„ . 
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